A newly disclosed vulnerability in Ivanti Connect Secure is already being weaponized against live enterprise networks, the Cybersecurity and Infrastructure Security Agency has confirmed. The flaw, tracked as CVE-2026-104935, allows attackers to bypass authentication entirely and execute commands on vulnerable VPN appliances without ever needing a valid credential. CISA added it to its Known Exploited Vulnerabilities catalog on October 13, 2026, a designation reserved for flaws with confirmed, real-world attack activity rather than theoretical risk.
A Bypass With Serious Reach
Connect Secure appliances sit at the edge of corporate networks, brokering remote access for employees and, critically, connecting outward to identity systems such as Active Directory. That positioning is exactly what makes this vulnerability dangerous: a successful compromise does not just expose the appliance itself, it opens a path into the authentication infrastructure that underpins an entire organization. Affected versions include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. CISA is urging immediate patching according to Ivanti's advisory and migration documentation, with no suggestion that mitigation short of upgrading is sufficient.
How the Attack Chain Actually Works
Security firm Volexity began investigating after spotting suspicious activity on October 5 on an appliance that was, at the time, running a fully patched version. Tracing the intrusion back to October 3, researchers attributed it to a threat actor they designate UTA0576. The technique is notable for its precision. Attackers exploited inconsistent request routing to reach protected administrative functionality through a login endpoint that should have required no prior authentication at all. A separate flaw in file-upload handling then gave them a narrow window to run an uploaded script before it was automatically deleted, after which subsequent stages executed Python code entirely in memory, leaving minimal trace on disk.
To escalate to root privileges, the attacker manipulated in-memory configuration tied to the appliance's privileged dsinvoked service, redirecting a routine maintenance task to run malicious code instead. Volexity notes that Ivanti plans a separate fix for this privilege-escalation component, distinct from the authentication bypass covered by CVE-2026-104935. Afterward, the payload quietly restored the original configuration and memory state, a deliberate step to minimize forensic evidence.
Credential Theft as the Real Objective
The intrusion was not about disruption. It was about harvesting credentials at scale. Volexity observed the attacker extracting domain credentials used for LDAP authentication directly from the appliance, then using a compromised Active Directory service account to search directory data for Local Administrator Password Solution entries, BitLocker recovery keys, and other password-bearing attributes. That is a methodical effort to acquire the kind of secrets that grant lateral movement across an entire Windows environment.
Additional reconnaissance included password spraying, review of authentication logs, internal DNS queries, and packet capture analysis aimed at plaintext LDAP credentials, HTTP Basic Authentication data, and NTLM challenge-response hashes. Rather than planting a persistent web shell that might be discovered, UTA0576 repeatedly re-ran the exploit chain itself, retrieving command output through ordinary HTTPS responses, and selectively deleted debug and Linux audit log entries to obscure the trail.
Why Standard Checks May Not Catch It
CISA has specifically cautioned that Ivanti's Integrity Checker Tool, which scans appliance disk state, may fail to detect this intrusion because the malicious activity runs in memory rather than being written to disk. Organizations suspecting compromise need network traffic analysis and memory forensics, not disk integrity results alone.
Recovery, where compromise is confirmed, goes well beyond installing a patch. CISA recommends backing up configuration, performing a factory reset, upgrading, and then restoring configuration for physical appliances, while cloud and virtual deployments should be rebuilt from scratch before restoration. Equally important: resetting domain, administrator, and local account passwords, revoking and reissuing certificates, and replacing API keys and license server credentials. Patching closes the door the attacker used to enter, but it does nothing to invalidate credentials already stolen. Organizations still running the 22.8 branch face an additional deadline, with end of life set for January 31, 2027, adding urgency to migration planning for any remote access infrastructure built around these appliances.